Yunpu's Sun World: Sun Campus Ambassador Canada

Hehe, just wanna take a rest.

Gary Serda

Get the skills you need for the best jobs. Through the Sun Academic Initiative (SAI), students are able to get free web-based training on Sun technologies and master the skills to fast-track their career. Leverage Sun's industry leading expertise and latest innovations to expand your knowledge of these leading technologies:

• Java technology


• Solaris OS system administration


• Java Enterprise System infrastructure products


• StarOffice productivity suite

Try to use BC Crypto APIs to implement the crypto core function in my system. The point is how to implement ECDSA in mobile device. The speed is a more complicated issue. Generating Key for ECDSA should be solved in this week.

http://www.bouncycastle.org/  contribute somethings to you:

The Bouncy Castle Crypto APIs for Java consist of the following:

A lightweight cryptography API for Java and C#.
A provider for the Java Cryptography Extension and the Java Cryptography Architecture.
A clean room implementation of the JCE 1.2.1.
A library for reading and writing encoded ASN.1 objects.
A light weight client-side TLS API.
Generators for Version 1 and Version 3 X.509 certificates, Version 2 CRLs, and PKCS12 files.
Generators for Version 2 X.509 attribute certificates.
Generators/Processors for S/MIME and CMS (PKCS7/RFC 3852).
Generators/Processors for OCSP (RFC 2560).
Generators/Processors for TSP (RFC 3161).
Generators/Processors for OpenPGP (RFC 2440).
A signed jar version suitable for JDK 1.4-1.6 and the Sun JCE.

Here is what my thesis lay on. I am currently working towards building the demo system. The system is implemented by Java ME and Java web application. I use NetBeans to program.

If I stored a private key in a tamper-resistant hardware, which can be plug-in with my mobile device, how can I use J2ME to read and operate this private key? Comparing with RMS, which is better choice for security of mobile transaction?

What is tamper-resistant hardware?

One part of designing a secure computer system is ensuring that various cryptographic keys can be accessed only by their intended user(s) and only for their intended purposes. Keys stored inside a computer can be vulnerable to use, abuse, and/or modification by an unauthorized attacker. For a variety of situations, an appropriate way to protect keys is to store them in a tamper-resistant hardware device. These devices can be used for applications ranging from secure e-mail to electronic cash and credit cards. They offer physical protection to the keys residing inside them, thereby providing some assurance that these keys have not been maliciously read or modified. Typically, gaining access to the contents of a tamper-resistant device requires knowledge of a PIN or password; exactly what type of access can be gained with this knowledge is device-dependent. Some tamper-resistant devices do not permit certain keys to be exported outside the hardware. This can provide a very strong guarantee that these keys cannot be abused: the only way to use these keys is to physically possess the particular device. Of course, these devices must actually be able to perform cryptographic functions with their protected keys, since these keys would otherwise be useless. Tamper-proof devices come in a variety of forms and capabilities. One common type of device is a ‘smart card,’ which is approximately the size and shape of a credit card. To use a smart card, one inserts it into a smart card reader that is attached to a computer. Smart Cards are frequently used to hold a user’s private keys for financial applications; Mondex is a system that makes use of tamper-resistant hardware in this fashion. [1] Frequently Asked Questions about Today's Cryptography, RSA Laboratories. version 4.1

Is there anybody who is familiar with PKI and the PKI implementation on mobile communication? I tried to build up a lightweight infrastructure to keep the security for mobile transaction. If you have any comments or information about mobile payment/transaction security or PKI, symmetric-key, public-key etc, or some implementation research based on JavaME/JavaEE, please feel free to leave them here. Also you can reach me via email: yunpu.zhu-AT-sun-DOT-com

 ------------------------------------------------------------------------Thanks

In cryptography, a public key infrastructure (PKI) is an arrangement that binds public keys with respective user identities by means of a certificate authority (CA). The user identity must be unique for each CA. The binding is established through the registration and issuance process, which, depending on the level of assurance the binding has, may be carried out by software at a CA, or under human supervision. The PKI role that assures this binding is called the Registration Authority (RA) . For each user, the user identity, the public key, their binding, validity conditions and other attributes are made unforgeable in public key certificates issued by the CA.

The term trusted third party (TTP) may also be used for certificate authority (CA). The term PKI is sometimes erroneously used to denote public key algorithms, which do not require the use of a CA.

PKI arrangements enable computer users without prior contact to be authenticated to each other, and to use the public key information in their public key certificates to encrypt messages to each other.^[1] In general, a PKI consists of client software, server software, hardware (e.g., smart cards), legal contracts and assurances, and operational procedures. A signer's public key certificate may also be used by a third-party to verify the digital signature of a message, which was made using the signer's private key. In general, a PKI enables the parties in a dialogue to establish confidentiality, message integrity and user authentication without having to exchange any secret information in advance, or even any prior contact. The validity of a PKI between the communicating parties is, however, limited by practical problems such as uncertain certificate revocation, CA conditions for certificate issuance and reliance, variability of regulations and evidentiary laws by jurisdiction, and trust.^[2] These problems, which are significant for the initial contact, tend to be less important as the communication progresses in time (including the use of other communication channels) and the parties have opportunities to develop trust on their identities and keys.^[2]

The Third Sun Tech Talk in the University of Lethbridge will be held on Jan 28. 

From 12:00 - 12:30 pm

In C620 UHall

Topic : Introduction of OpenSolaris 

Refeshment will be available.

Update: Sun Dangles Prize Money over Open-Source Efforts

Totally from my personal interests. It's a good guide to how to demo software. Joel sometimes provide us some hint. 

http://www.joelonsoftware.com/items/2007/11/16.html